T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:48- Finding
API Server Binds to All Network Interfaces Without Documented Access Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Fish Audio S2 Pro TTS
Security checks for vulnerabilities and agentic risk
Overview
This TTS skill is mostly coherent documentation, but it asks users to run exposed voice-cloning services and mutable installs without enough scoping or safety guidance.
Review this skill before installing. Prefer loopback-only services, pin package/model/container versions or digests, avoid arbitrary URL and file:// reference audio, and only use voice cloning with explicit permission from the speaker. Treat uploaded voice samples as sensitive biometric data and confirm how they are retained or deleted.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:19- Finding
Installation Instructions Retrieve Unpinned Executable Dependencies and Model Artifacts
- Content
View full analysis
- Remediation
View remediation
``` 5. Pin Hugging Face downloads to a reviewed commit revision and verify expected file checksums: ```bash hf download fishaudio/s2-pro \ --revision \ --local-dir checkpoints/s2-pro ``` 6. Publish a software bill of materials covering packages, images, and downloaded model artifacts. 7. Verify package publisher identities and use trusted package indexes with explicit index configuration. 8. Perform installation in an isolated, non-privileged environment without access to secrets or unrelated user files. 9. Run containers as a non-root user with read-only filesystems, minimal mounts, dropped Linux capabilities, and restricted outbound networking. 10. Document the exact package versions, image digests, model revisions, and checksums that were security-reviewed. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
API Calls
cURL
bash # Basic TTS
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly documents voice-cloning behavior but provides no warning about consent, impersonation, or privacy risks. In a TTS skill, this materially increases misuse risk because users are guided to submit reference audio and generate cloned speech without any guardrails or policy cues.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
-d '{"input": "Streaming.", "stream": true, "response_format": "pcm"}' --no-buffer | play -t raw -r 44100 -e signed -b 16 -c 1 -
Batch
curl -X POST http://localhost:8091/v1/audio/speech/batch
-H "Content-Type: application/json"
-d '{"items": [{"input": "Sentence 1"}, {"input": "Sentence 2"}], "voice": "default"}'text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests resp = requests.post("http://localhost:8091/v1/audio/speech", json={ "input": "Hello.", "voice": "default", "ref_audio": "https://...", "ref_text": "Reference text" })
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests resp = requests.post("http://localhost:8091/v1/audio/speech", json={ "input": "Hello.", "voice": "default", "ref_audio": "https://...", "ref_text": "Reference text" })
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
python import requests resp = requests.post("http://localhost:8091/v1/audio/speech", json={ "input": "Hello.", "voice": "default", "ref_audio": "https://...", "ref_text": "Reference text" })
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Allowing ref_audio to come from URL, base64, or file:// sources without warning or restriction creates privacy and local file access risk. If an implementation follows this interface naively, it may fetch attacker-controlled URLs or read local files, leading to SSRF, sensitive file exposure, or processing of private data without user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file documents uploading a voice sample and deleting a voice, including that uploaded data is persisted under the user's cache directory, but it does not provide any explicit warning about privacy implications, persistence, or the destructive nature of deletion. For markdown files, operations affecting user data or system state should include clear user-facing warnings.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Upload:
bash curl -X POST http://localhost:8091/v1/audio/voices \ -F "audio_sample=@voice.wav" -F "consent=user_id" \ -F "name=my_voice" -F "ref_text=Transcript." -F "speaker_description=warm narrator"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests, json, base64, io, wave with requests.post(..., json={..., "stream": True}, stream=True) as s: chunks, fmt = [], None for line in s.iter_lines(decode_unicode=True): if not line or not line.startswith("data: ") or "[DONE]" in line: continue
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The installation guide instructs users to pull a Docker image without pinning a specific tag or immutable digest, so the content retrieved can change over time. This creates a supply-chain risk: if the publisher account is compromised or the latest image is replaced with a malicious or broken build, users may run unreviewed code.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 78% confidence
- Finding
This
docker runexample executes the same unpinned image reference, which may resolve to whatever local or remote image currently matchesfish-speech:webui. If users build or pull a different image under that tag, the command can run unexpected code with GPU access and mounted host directories, increasing supply-chain and host exposure risks.- Content